Vulnerability-Lookup

GHSA-WGW5-9P87-VHVP

Vulnerability from github – Published: 2026-11-04 18:30 – Updated: 2026-11-04 18:30

Details

The resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling "https://evil.example/steal" receives none. The same happens with a different port or user-info part on the same host.

This is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri and credentials, including those created with HttpClient::createForBaseUri() or configured under framework.http_client.scoped_clients.

To solve the issue, after resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.

Severity

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-121971"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-04T18:17:43Z",
    "severity": "HIGH"
  },
  "details": "The component ScopingHttpClient\u00a0in Symfony HttpClient\u00a0merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as \"//evil.example/steal\"\u00a0to be sent to another origin together with the default scope\u2019s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server.\u00a0This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\nThe resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling \"https://evil.example/steal\" receives none. The same happens with a different port or user-info part on the same host.\n\n\n\n\n\n\n\n\n\nThis is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri\u00a0and credentials, including those created with HttpClient::createForBaseUri()\u00a0or configured under framework.http_client.scoped_clients.\n\nTo solve the issue, after\u00a0resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.",
  "id": "GHSA-wgw5-9p87-vhvp",
  "modified": "2026-11-04T18:30:55Z",
  "published": "2026-11-04T18:30:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/security/advisories/GHSA-gq53-v8w2-gjhj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121971"
    },
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/commit/64c34e85bd03b3f8a735d8e1af393659dda91d7c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-121971 (GCVE-0-2026-121971)

Vulnerability from cvelistv5 – Published: 2026-11-04 17:43 – Updated: 2026-11-05 19:07

Title

Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References

Summary

The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together with the default scope’s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server. This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling "https://evil.example/steal" receives none. The same happens with a different port or user-info part on the same host. This is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri and credentials, including those created with HttpClient::createForBaseUri() or configured under framework.http_client.scoped_clients. To solve the issue, after resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 21:11 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-522 - Insufficiently Protected Credentials

Assigner

Checkmarx CNA under the mitre root

CNA scorecard B 88/100 over 15 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/symfony/symfony/security/advis…	third-party-advisory
https://github.com/symfony/symfony/commit/64c34e8…	patch

Impacted products

1 product

Vendor	Product	Version
sensiolabs	symfony	Affected: 0 , < 5.4.56 (git) Affected: 6.0.0 , < 6.4.50 (git) Affected: 7.0.0 , < 7.4.23 (git) Affected: 8.0.0 , < 8.1.11 (git) cpe:2.3:a:sensiolabs:symfony:::::::: cpe:2.3:a:sensiolabs:symfony:::::::: cpe:2.3:a:sensiolabs:symfony:::::::: cpe:2.3:a:sensiolabs:symfony::::::::

Credits

Nicolas Grekas Thomas Chauchefoin from Trail of Bits

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121971",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T21:11:51.149301Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:07:02.219Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/packages/symfony/http-client",
          "defaultStatus": "unaffected",
          "modules": [
            "Symfony\\Component\\HttpClient\\ScopingHttpClient"
          ],
          "packageName": "symfony/http-client",
          "product": "symfony",
          "repo": "https://github.com/symfony/http-client",
          "vendor": "sensiolabs",
          "versions": [
            {
              "lessThan": "5.4.56",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            },
            {
              "lessThan": "6.4.50",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "7.4.23",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "8.1.11",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.56",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.50",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.23",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.1.11",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nicolas Grekas"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Chauchefoin from Trail of Bits"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe component \u003ccode\u003eScopingHttpClient\u003c/code\u003e\u0026nbsp;in Symfony HttpClient\u0026nbsp;merges the options of its default scope (such as \u003ccode\u003eauth_bearer\u003c/code\u003e or \u003ccode\u003eauth_basic\u003c/code\u003e) into a request before resolving a relative URL against the \u003ccode\u003ebase_uri\u003c/code\u003e, allowing a network-path reference such as \"\u003ccode\u003e//evil.example/steal\"\u003c/code\u003e\u0026nbsp;to be sent to another origin together with the default scope\u2019s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server.\u0026nbsp;\u003cspan\u003eThis affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eThe resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling \"\u003ccode\u003ehttps://evil.example/steal\"\u003c/code\u003e receives none. The same happens with a different port or user-info part on the same host.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eThis is reachable whenever an attacker controls the beginning of a URL passed to a client built with a b\u003ccode\u003ease_uri\u003c/code\u003e\u0026nbsp;and credentials, including those created with \u003ccode\u003eHttpClient::createForBaseUri()\u003c/code\u003e\u0026nbsp;or configured under \u003ccode\u003eframework.http_client.scoped_clients\u003c/code\u003e.\u003cbr\u003e\u003cbr\u003eTo solve the issue, after\u003cspan\u003e\u0026nbsp;resolving a relative URL against the base URI of the default scope, \u003c/span\u003e\u003ccode\u003eScopingHttpClient\u003c/code\u003e\u003cspan\u003e now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.\u0026nbsp;\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "The component ScopingHttpClient\u00a0in Symfony HttpClient\u00a0merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as \"//evil.example/steal\"\u00a0to be sent to another origin together with the default scope\u2019s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server.\u00a0This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\nThe resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling \"https://evil.example/steal\" receives none. The same happens with a different port or user-info part on the same host.\n\n\n\n\n\n\n\n\n\nThis is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri\u00a0and credentials, including those created with HttpClient::createForBaseUri()\u00a0or configured under framework.http_client.scoped_clients.\n\nTo solve the issue, after\u00a0resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T17:43:34.806Z",
        "orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
        "shortName": "Checkmarx"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/symfony/symfony/security/advisories/GHSA-gq53-v8w2-gjhj"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/symfony/symfony/commit/64c34e85bd03b3f8a735d8e1af393659dda91d7c"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
    "assignerShortName": "Checkmarx",
    "cveId": "CVE-2026-121971",
    "datePublished": "2026-11-04T17:43:34.806Z",
    "dateReserved": "2026-11-04T13:03:55.851Z",
    "dateUpdated": "2026-11-05T19:07:02.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted